@hcmai/cli

The official HCM Next command-line interface for business APIs, tenant delivery, workspaces, and AI agents.

Install

npm install --global @hcmai/cli
hcm --version

Node.js 22 or newer is required.

First connection

hcm env add production --endpoint https://hcm.example.com
hcm login https://hcm.example.com --code <one-time-pairing-code>
hcm env current
hcm identity show <identity-alias> --output json

The npm package is public. Application credentials are not included in the package and are stored locally through the HCM login flow. identity show uses that alias's stored token to return the live userId, username, tenantId, and roles without printing the token.

Source and release automation are maintained in CNB.

Project environments

A project env.yaml can declare default and named environments, each with endpoint, frontend, tenant, optional roles, and danger. Legacy three-line files remain supported. --env first matches a project name, then a local slot. Connection provenance is printed to stderr; writes to danger: true environments require --allow-danger. Credentials stay in the local identity store.

Delivery projects

hcm chiron init scaffolds a consultant project: env.yaml, the working directories, and the managed block in AGENTS.md / CLAUDE.md. Skills come from hcm chiron skills sync (targets: codex, claude); the repo-local codex target maintains the skill index in AGENTS.md and mirrors it to an existing CLAUDE.md, so a dual-agent project shares one locked skill tree. Since 0.14.0 the codex target splits that tree by ownership: hcm-skills/sync/ is mirrored from the product (the CLI owns it outright, lockfile included) and hcm-skills/local/ holds the consultant's own skills, which the CLI never writes. Same id on both sides: local/ shadows sync/. The claude target stays flat (.claude/skills/) because Claude Code only discovers one level deep.

Page acceptance is hcm chiron page. It mints the same short-lived hcm open ticket, drives local Chrome/Chromium headless, and writes a non-overwriting PNG under the project's evidence/ directory. At least one --expect-text is mandatory — a login page, an error page and a blank page all produce a screenshot, so "a screenshot exists" is not evidence:

hcm chiron page /dashboard/<id> --env acme-dev --as consultant-acme-dev \
  --expect-text '<dashboard title>' --reject-text '未知组件类型' \
  --out evidence/acme-dev/<date>-dashboard/page.png

Exit code is 0 when the page carries every --expect-text and none of the --reject-text, and 3 when it does not; the screenshot is kept either way so a human can see whether it was a login page, an error page, or a real gap.